Server-facing API endpoints used by the AdvancedAuth Minecraft plugin for authentication, session management, and email OTP.
https://plugins.zenuxs.inx-api-key header. The server key is sent via the x-server-key header. The player's real IP must be sent via the x-player-ip header for login and session validation.
Validate a player's password or session token. This is the primary authentication endpoint used by the plugin. Supports both password-based and session-based auth.
| Param | Type | Required | Description |
|---|---|---|---|
| tag | string | Yes* | Username (not needed if sessionToken provided) |
| password | string | Yes* | Password (not needed if sessionToken provided) |
| sessionToken | string | No | Validate an existing session instead of password |
| serverKey | string | No | Server key to scope the query |
{
"valid": true,
"exists": true,
"username": "john",
"email": "john@example.com",
"isBanned": false,
"timestamp": "23/06/2026, 14:30:45"
}{
"valid": true,
"exists": true,
"username": "john",
"email": "john@example.com",
"isBanned": false,
"usingSession": true,
"expiresAt": "2026-06-27T14:30:45.000Z"
}Register a new player on the server.
{
"username": "john",
"password": "securePass123",
"email": "john@example.com",
"licenseKey": "PREMIUM-2026-XXXXXX"
}{
"message": "User registered successfully",
"username": "john"
}{
"error": "Username already taken for this server",
"code": "USERNAME_TAKEN"
}Authenticate a player and create a session. Rate-limited to 5000 req/15min. All previous sessions for the player are invalidated on new login.
| Header | Required | Description |
|---|---|---|
| x-api-key | Yes | Your API key |
| x-player-ip | Yes | Player's real IP (set by plugin) |
{
"username": "john",
"password": "securePass123",
"sessionDuration": 24,
"premium": false
}{
"message": "Login successful",
"username": "john",
"sessionToken": "a1b2c3d4e5f6...",
"expiresIn": "24 hours",
"premium": false,
"ipAddress": "192.168.1.100",
"timestamp": "23/06/2026, 14:30:45"
}Validate a session token with IP matching to prevent token theft.
| Header | Required | Description |
|---|---|---|
| x-api-key | Yes | Your API key |
| x-player-ip | Yes | Player IP for security matching |
{ "sessionToken": "a1b2c3d4e5f6..." }{
"valid": true,
"username": "john",
"email": "john@example.com",
"expiresAt": "2026-06-24T14:30:45.000Z",
"ipAddress": "192.168.1.100",
"timeRemaining": 23.5
}{ "valid": false, "error": "Invalid or expired session" }
{ "valid": false, "error": "IP mismatch - please login again" }Invalidate a single session token.
{ "sessionToken": "a1b2c3d4e5f6..." }{ "success": true, "message": "Logged out successfully" }Invalidate all sessions for a player globally or per-server.
{
"username": "john",
"scope": "global"
}{ "success": true, "message": "All sessions invalidated" }Automatically log in a player by their IP address if they have an active session from that IP.
{
"ipAddress": "192.168.1.100"
}Validate a server key token. Used by the plugin on startup to verify the server key is valid and the plugin is enabled.
{ "token": "c126434b-eaf2-439a-a759-ca7600a7e146" }{
"valid": true,
"serverKey": "My Server",
"pluginEnabled": true
}Check if the plugin is enabled for the server key and return valid license information.
{
"enabled": true,
"serverKey": "c126434b-...",
"validLicenses": 2,
"message": "Plugin is enabled"
}Set or update a player's email address.
{
"username": "john",
"email": "john@example.com"
}{
"success": true,
"message": "Email updated successfully",
"username": "john",
"email": "john@example.com"
}Request a one-time password reset OTP sent to the player's registered email.
{ "email": "john@example.com" }{
"success": true,
"otp": "482915",
"message": "OTP sent to your email"
}Verify OTP and set a new password.
{
"email": "john@example.com",
"otp": "482915",
"newPassword": "newSecurePass123"
}{ "success": true, "message": "Password changed successfully" }Request a password reset OTP using username and server key instead of email.
{
"username": "john",
"serverKey": "your-server-key"
}{ "success": true, "message": "OTP sent to your registered email" }Verify OTP received via username-based reset and set a new password.
{
"username": "john",
"otp": "482915",
"newPassword": "newSecurePass123",
"serverKey": "your-server-key"
}{ "success": true, "message": "Password changed successfully" }Request OTP to change a player's email address.
{
"username": "john",
"newEmail": "newemail@example.com"
}Verify OTP and update the email address.
{
"username": "john",
"newEmail": "newemail@example.com",
"otp": "482915"
}Get a player's profile including IP history and account age.
| Param | Required | Description |
|---|---|---|
| username | Yes | The player username |
{
"username": "john",
"email": "john@example.com",
"createdAt": "2026-01-15T10:30:00.000Z",
"lastLogin": "2026-06-23T14:30:45.000Z",
"emailVerified": true,
"totalLogins": 42,
"uniqueIPs": 3,
"accountAge": "160 days"
}List all active sessions for a player.
| Param | Required | Description |
|---|---|---|
| username | Yes | The player username |
{
"username": "john",
"activeSessions": [
{
"ipAddress": "192.168.1.100",
"createdAt": "2026-06-23T14:30:00.000Z",
"expiresAt": "2026-06-24T14:30:00.000Z"
}
],
"totalSessions": 1
}